CVE-2023-27990

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.

• zyxel atp200 firmware (>= 4.32 < 5.36) • zyxel atp100 firmware (>= 4.32 < 5.36) • zyxel atp700 firmware (>= 4.32 < 5.36) • zyxel atp500 firmware (>= 4.32 < 5.36) • zyxel atp100w firmware (>= 4.32 < 5.36) • zyxel atp800 firmware (>= 4.32 < 5.36) • zyxel usg flex 100 firmware (>= 4.50 < 5.36) • zyxel usg flex 50 firmware (>= 4.50 < 5.36) • zyxel usg flex 200 firmware (>= 4.50 < 5.36) • zyxel usg flex 500 firmware (>= 4.50 < 5.36) • zyxel usg flex 700 firmware (>= 4.50 < 5.36) • zyxel usg flex 100w firmware (>= 4.50 < 5.36) • zyxel usg 20w-vpn firmware (>= 4.16 < 5.36) • zyxel usg flex 50w firmware (>= 4.16 < 5.36) • zyxel usg20-vpn firmware (>= 4.30 < 5.36) • zyxel vpn100 firmware (>= 4.30 < 5.36) • zyxel vpn1000 firmware (>= 4.30 < 5.36) • zyxel vpn300 firmware (>= 4.30 < 5.36) • zyxel vpn50 firmware (>= 4.30 < 5.36)